mgre配置实验-CSDN博客

本文链接：https://blog.csdn.net/m0_46681256/article/details/129674411

该实验详细描述了如何配置网络设备间的PPP认证（包括PAP和CHAP），使用HDLC封装，建立GRE点到点隧道以及MGRE多点隧道。同时，通过RIP协议实现了全网路由可达，并设置了NAT规则允许私有IP访问公网环回地址。

摘要由CSDN通过智能技术生成

1.实验要求

1,R5为ISP，只能进行IP地址配置；其所有地址均配为公有IP地址

2，R1和R5间使用PPP的PAP认证，R5为主认证方；R2于R5之间使用PPP的chap认证，R5为主认证方；R3于R5之间使用HDLC封装。

3, R1/R2/R3构建一个MGRE环境, R1为中心站点; R1、R4间为点到点的GRE。

4,整个私有网络基于RIP全网可达

5,所有PC设置私有IP为源IP,可以访问R5环回。

首先进行r1和r2使用ppp的pap认证

[r1]int s2/0/0
[r1-Serial2/0/0]ip add 10.0.0.1 24
[r5]int s1/0/0
[r5-Serial1/0/0]ip add 10.0.0.2 24
[r5-Serial1/0/0]q
[r5]aaa      
[r5-aaa]local-user www password cipher 123  #创建本地用户的用户名和密码
Info: Add a new user.  
[r5-aaa]local-user www service-type ppp #指定本地用户使用的服务类型为PPP
[r5-aaa]int s1/0/0  
[r5-Serial1/0/0]ppp authentication-mode pap #开启pap认证
[r5-Serial1/0/0]shutdown   #重启认证
[r5-Serial1/0/0]undo shutdown
[r1-Serial2/0/0]ppp pap local-user www password cipher 123

r2和r5使用ppp的chap认证

[r5]int s1/0/1
[r5-Serial1/0/1]ip add 15.0.0.2 24    
[r5-Serial1/0/1]ppp authentication-mode chap
[r5-Serial1/0/1]shutdown   
[r5-Serial1/0/1]undo shutdown 
[r2]int s2/0/0
[r2-Serial2/0/0]ip add 15.0.0.1 24
[r2-Serial2/0/0]ppp chap user www   
[r2-Serial2/0/0]ppp chap password cipher 123

r5和r3之间的实验hdlc封装

[r5]int s2/0/0
[r5-Serial2/0/0]ip add 20.0.0.2 24   
[r5-Serial2/0/0]link-protocol hdlc
Warning: The encapsulation protocol of the link will be changed. Continue? [Y/N]
:y
[r3]int s2/0/0
[r3-Serial2/0/0]ip add 20.0.0.1 24   
[r3-Serial2/0/0]link-protocol hdlc
Warning: The encapsulation protocol of the link will be changed. Continue? [Y/N]
:y

r5和r4

[r4]int g0/0/1
[r4-GigabitEthernet0/0/1]ip add 25.0.0.1 24
[r5]int g0/0/0
[r5-GigabitEthernet0/0/0]ip add 25.0.0.2 24

r5创建环回

[r5]int e0/0/0
[r5-Ethernet0/0/0]int lo0
[r5-LoopBack0]ip add 5.5.5.5 24

公网配置完成

配置私网ip和环回

[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]ip add 192.168.1.1 24 
[r1-GigabitEthernet0/0/0]q    
[r1]ip route-static 0.0.0.0 0 10.0.0.2

[r2]int g0/0/0
[r2-GigabitEthernet0/0/0]ip add 192.168.2.1 24
[r2-GigabitEthernet0/0/0]q
[r2]ip route-static 0.0.0.0 0 15.0.0.2

[r3]int g0/0/0
[r3-GigabitEthernet0/0/0]ip add 192.168.3.1 24
[r3-GigabitEthernet0/0/0]q   
[r3]ip route-static 0.0.0.0 0 20.0.0.2

[r4]int g0/0/0
[r4-GigabitEthernet0/0/0]ip add 192.168.4.1 24 
[r4-GigabitEthernet0/0/0]q   
[r4]ip route-static 0.0.0.0 0 25.0.0.2

实现r1和r4点到点的GRE

[r1]int Tunnel 0/0/0   
[r1-Tunnel0/0/0]tunnel-protocol gre   
[r1-Tunnel0/0/0]source 10.0.0.1
[r1-Tunnel0/0/0]destination 25.0.0.1

[r4]int Tunnel 0/0/0
[r4-Tunnel0/0/0]source 25.0.0.1
[r4-Tunnel0/0/0]destination 10.0.0.1

完成后试着ping 25.0.0.1看能不能ping通，来检验是否写好了gre

实现r1和r2,r3,mgre网络r1为中心站点

[r1]int Tunnel 0/0/1
[r1-Tunnel0/0/1]ip add 192.168.6.1 24
[r1-Tunnel0/0/1]tunnel-protocol gre p2mp     
[r1-Tunnel0/0/1]source 10.0.0.1   
[r1-Tunnel0/0/1]nhrp entry multicast dynamic   #开启伪广播 
[r1-Tunnel0/0/1]nhrp network-id 100  #配置nhrp

[r2]int Tunnel 0/0/0
[r2-Tunnel0/0/0]ip add 192.168.6.2 24    
[r2-Tunnel0/0/0]tunnel-protocol gre p2mp     
[r2-Tunnel0/0/0]source s2/0/0   
[r2-Tunnel0/0/0]nhrp entry 192.168.6.1 10.0.0.1 register  #找中心注册
#前面隧道接口ip，后面隧道的真实物理ip，都是对端
[r2-Tunnel0/0/0]nhrp network-id 100  #查看邻居情况

[r3]int Tunnel 0/0/0
[r3-Tunnel0/0/0]ip add 192.168.6.3 24        
[r3-Tunnel0/0/0]tunnel-protocol gre p2mp  
[r3-Tunnel0/0/0]source s2/0/0      
[r3-Tunnel0/0/0]nhrp entry 192.168.6.1 10.0.0.1  register  
[r3-Tunnel0/0/0]nhrp network-id 100

验证r1 ping r2

验证r2 ping r3

整个私网基于rip实现全网通

[r1]rip
[r1-rip-1]v 2   
[r1-rip-1]un summary     
[r1-rip-1]network 192.168.1.0   
[r1-rip-1]network 192.168.6.0
[r1-rip-1]network 192.168.5.0

[r2]rip
[r2-rip-1]v 2    
[r2-rip-1]un silent-interface
[r2-rip-1]un summary   
[r2-rip-1]network 192.168.2.0   
[r2-rip-1]network 192.168.6.0

[r3]rip
[r3-rip-1]v 2        
[r3-rip-1]undo summary    
[r3-rip-1]network 192.168.3.0   
[r3-rip-1]network 192.168.6.0

[r4]rip
[r4-rip-1]v 2    
[r4-rip-1]un summary     
[r4-rip-1]network 192.168.4.0
[r4-rip-1]network 192.168.5.0

   
[r1]interface Tunnel 0/0/1   
[r1-Tunnel0/0/1]undo rip split-horizon #关闭rip水平分割

配置PC的ip

所有PC设置私有IP为源IP,可以访问R5环回。

[r1]acl 2000    
[r1-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[r1-acl-basic-2000]int s2/0/0    
[r1-Serial2/0/0]nat outbound 2000

[r2]acl 2000    
[r2-acl-basic-2000]rul permit source 192.168.2.0 0.0.0.255   
[r2-acl-basic-2000]int s2/0/0    
[r2-Serial2/0/0]nat outbound 2000

[r3]acl 2000   
[r3-acl-basic-2000]rule permit source 192.168.3.0 0.0.0.255
[r3-acl-basic-2000]int s2/0/0    
[r3-Serial2/0/0]nat outbound 2000

[r4]acl 2000   
[r4-acl-basic-2000]rule permit source 192.168.4.0 0.0.0.255
[r4-acl-basic-2000]int g0/0/1   
[r4-GigabitEthernet0/0/1]nat outbound 2000